AI Slop Code Risk Monitor

GitoxideLabs/gitoxide

SlopCodeMonitor badge for GitoxideLabs/gitoxide Adjusted legacy signal; badge bands: 25 / 50 / 75 (different from dashboard bands).

A tasteful, lean, fast & safe pure Rust implementation of Git

1.9 Low pattern signal View on GitHub

Open-Source Code Quality, Security and Technical Debt Review

This report summarizes scanner evidence for GitoxideLabs/gitoxide, a Rust project with 12,093 GitHub stars. SynthScan examined 583,527 lines of code across 2075 source files, recording 1059 pattern matches distributed across 10 syntactic categories. The legacy adjusted pattern signal is 1.9 (Low pattern signal); it is not an authorship estimate.

Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.

1.9
Adjusted Signal
1.9
Raw Pattern Score
100%
Time Factor
2026-10-31
Last Push
12.1K
Stars
Rust
Language
583.5K
Lines of Code
2.1K
Files
1.1K
Pattern Hits
2026-10-31
Scan Date
0.00
HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 8.9/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 1039 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.3/100 · LOW

Are imports declared and package/API names verified? 19 finding(s).

Agent Over-Engineering Ratio 0.0/100 · LOW

Are wrappers, guards, and repeated structures necessary? 1 finding(s).

PR Review Velocity Impact 9.1/100 · LOW

Which changes need focused human review? 1059 finding(s).

What These Metrics Mean

Adjusted Signal
Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score
Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor
A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits
Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate
High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files
Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 1HIGH 1MEDIUM 21LOW 1036

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 1059 distinct pattern matches across 10 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block1014 hits · 1005 pts
SeverityFileLineSnippetContext
LOWCargo.toml101##COMMENT
LOWCargo.toml221#! Blocking and async features are mutually exclusive and cause a compile-time error. This also means that `cargo … --alCOMMENT
LOWCargo.toml401[workspace.lints.rust]COMMENT
LOWdeny.toml1# Note that all fields that take a lint level have these possible values:COMMENT
LOWgix-zlib/src/lib.rs1#![deny(missing_docs)]COMMENT
LOWgix-zlib/src/lib.rs61#[derive(Copy, Clone, PartialEq, Eq, Debug)]COMMENT
LOWgix-zlib/src/lib.rs81 /// data has yet to be processed.COMMENT
LOWgix-zlib/src/stream/deflate/mod.rs101 /// accumulate before producing output in order to maximize compression.COMMENT
LOWgix-sec/tests/sec/identity.rs41#[test]COMMENT
LOWgix-sec/src/lib.rs1//! A shared trust model for `gitoxide` crates.COMMENT
LOWgix-negotiate/src/lib.rs21 /// The revision is known to be in common with the remote.COMMENT
LOWgix-transport/Cargo.toml41## NOTE: `https://` is NOT supported by default. You must enable one of the `http-client-reqwest-rust-tls`COMMENT
LOWgix-transport/tests/client/blocking_io/http/mod.rs481 error: AuthenticationRequired {COMMENT
LOWgix-transport/tests/client/blocking_io/http/mod.rs501///COMMENT
LOWgix-transport/src/lib.rs1//! An implementation of the `git` transport layer, abstracting over all of its [versions][Protocol].COMMENT
LOWgix-transport/src/lib.rs21COMMENT
LOWgix-transport/src/client/non_io_types.rs1/// Configure how a `RequestWriter` behaves when writing bytes.COMMENT
LOWgix-transport/src/client/traits.rs21 fn set_identity(&mut self, _identity: gix_sec::identity::Account) -> std::result::Result<(), Error> {COMMENT
LOWgix-transport/src/client/async_io/bufread_ext.rs21/// This trait exists to get a version of a `gix_packetline::Provider` without type parameters,COMMENT
LOWgix-transport/src/client/async_io/traits.rs21 /// In protocol version one, this is set to a list of refs and their peeled counterparts.COMMENT
LOWgix-transport/src/client/blocking_io/request.rs101 ///COMMENT
LOWgix-transport/src/client/blocking_io/bufread_ext.rs21pub trait ReadlineBufRead: io::BufRead {COMMENT
LOWgix-transport/src/client/blocking_io/traits.rs21}COMMENT
LOWgix-transport/src/client/blocking_io/http/mod.rs61 /// The way to configure a proxy for authentication if a username is present in the configured proxy.COMMENT
LOWgix-transport/src/client/blocking_io/http/mod.rs121COMMENT
LOWgix-transport/src/client/blocking_io/http/mod.rs141 /// of bytes per second isn't reached.COMMENT
LOWgix-transport/src/client/blocking_io/http/mod.rs161 /// If not overridden, it defaults to the user agent provided by `curl`, which is a deviation from how `git` handlesCOMMENT
LOWgix-diff/tests/diff/blob/slider.rs181 /// This isolates whether the selected Myers or Histogram algorithm already agrees with Git.COMMENT
LOWgix-diff/tests/diff/blob/slider.rs201/// [`PostprocessNoHeuristicMatchesGitNoIndent`](Self::PostprocessNoHeuristicMatchesGitNoIndent),COMMENT
LOWgix-diff/tests/diff/blob/slider.rs221 /// This comparison is available only in extended-report mode, which loads the additionalCOMMENT
LOWgix-diff/benches/blob.rs1//! In-memory blob diffs: `cargo bench -p gix-diff --bench blob`.COMMENT
LOWgix-diff/src/lib.rs1//! Algorithms for diffing various git object types and for generating patches, highly optimized for performance.COMMENT
LOWgix-diff/src/lib.rs21pub struct Rewrites {COMMENT
LOWgix-diff/src/rewrites/mod.rs21/// Determine in which set of files to search for copies.COMMENT
LOWgix-diff/src/rewrites/tracker.rs41 /// conversions. What matters is that the IDs are comparable.COMMENT
LOWgix-diff/src/rewrites/tracker.rs181 /// Can only be called once effectively as it alters its own state to assure each item is only emitted once.COMMENT
LOWgix-diff/src/tree/visit.rs1use gix_hash::ObjectId;COMMENT
LOWgix-diff/src/tree/function.rs1use std::{borrow::BorrowMut, collections::VecDeque};COMMENT
LOWgix-diff/src/tree_with_rewrites/change.rs21 /// making it easy to reconstruct the top-level of directory changes.COMMENT
LOWgix-diff/src/tree_with_rewrites/change.rs41 /// An entry was modified, e.g. changing the contents of a file adjusts its object id and turningCOMMENT
LOWgix-diff/src/tree_with_rewrites/change.rs61 /// In case of renames, this means they originally appeared as [`Deletion`](ChangeRef::Deletion) signalling their soCOMMENT
LOWgix-diff/src/tree_with_rewrites/change.rs81 ///COMMENT
LOWgix-diff/src/tree_with_rewrites/change.rs101 /// points to a deleted object, as renames are tracked as deletions and additions of the same or similar contentCOMMENT
LOWgix-diff/src/tree_with_rewrites/change.rs121 id: gix_hash::ObjectId,COMMENT
LOWgix-diff/src/tree_with_rewrites/change.rs141 ///COMMENT
LOWgix-diff/src/tree_with_rewrites/change.rs161 /// This variant can only be encountered if [rewrite tracking](super::Options::rewrites) is enabled.COMMENT
LOWgix-diff/src/tree_with_rewrites/change.rs181 diff: Option<DiffLineStats>,COMMENT
LOWgix-diff/src/tree_with_rewrites/function.rs1use bstr::BStr;COMMENT
LOWgix-diff/src/index/mod.rs61 previous_id: Cow<'lhs, gix_hash::oid>,COMMENT
LOWgix-diff/src/index/function.rs21///COMMENT
LOWgix-diff/src/blob/mod.rs1//! For using text diffs, please have a look at the [`imara-diff` documentation](https://docs.rs/imara-diff),COMMENT
LOWgix-diff/src/blob/mod.rs21/// ```COMMENT
LOWgix-diff/src/blob/mod.rs61}COMMENT
LOWgix-diff/src/blob/mod.rs81 /// Please note that we don't make this call ourselves, but use it to determine that we should not run the our standCOMMENT
LOWgix-diff/src/blob/mod.rs101/// the content is considered binary.COMMENT
LOWgix-diff/src/blob/mod.rs121 path: PathBuf,COMMENT
LOWgix-diff/src/blob/pipeline.rs41}COMMENT
LOWgix-diff/src/blob/pipeline.rs61 /// Note that technically, the size isn't always representative of the same 'state' of theCOMMENT
LOWgix-diff/src/blob/pipeline.rs81#[derive(Default, Clone, Copy, PartialEq, Eq, Debug, Hash, Ord, PartialOrd)]COMMENT
LOWgix-diff/src/blob/pipeline.rs161 }COMMENT
954 more matches not shown…
AI Slop Vocabulary14 hits · 46 pts
SeverityFileLineSnippetContext
MEDIUMCargo.toml44## When used in conjunction with `http-client-curl-rustls`, the `openssl` crates will still be compiled, but won't be usCOMMENT
MEDIUM⚡gix-transport/Cargo.toml32## If used in conjunction with other blocking implementations like `http-client-reqwest`, this one takes precedence.COMMENT
MEDIUM⚡gix-transport/Cargo.toml35## If used in conjunction with `http-client-curl-openssl`, this feature will take precedence.COMMENT
MEDIUM⚡gix-transport/Cargo.toml38## If used in conjunction with `http-client-curl-rust-tls`, the `rust-tls` feature will take precedence.COMMENT
MEDIUMgix-transport/Cargo.toml58## Suitable for implementing your own transports while using git's way of communication, typically in conjunction with aCOMMENT
MEDIUMgix-transport/Cargo.toml131## If used in conjunction with `async-client`, the `connect()` method will become available along with supporting the giCOMMENT
MEDIUMgix-imara-diff/Cargo.toml37# harness = falseCOMMENT
MEDIUMgix/Cargo.toml271## Make certain data structure threadsafe (or `Sync`) to facilitate multithreading. Further, many algorithms will now usCOMMENT
MEDIUMgix/src/lib.rs71//! to understand which cache levels exist and how to leverage them.COMMENT
MEDIUMgix/src/revision/walk.rs163/// **Note that we automatically leverage the commitgraph data structure**, but if you know that additional information COMMENT
MEDIUMgix-hashtable/src/lib.rs54 /// A Hasher for usage with `HashMap` keys that are already robust hashes (like an `ObjectId`).COMMENT
MEDIUMgix-hashtable/src/lib.rs94 /// A Hasher for usage with `HashMap` keys that are already robust hashes (like an `ObjectId`).COMMENT
MEDIUMgix-hashtable/src/lib.rs107/// A `HashMap` for usage with keys that are already robust hashes (like an `ObjectId`).COMMENT
MEDIUMgix-hashtable/src/lib.rs110/// A `HashSet` for usage with keys that are already robust hashes (like an `ObjectId`).COMMENT
Fake / Example Data18 hits · 24 pts
SeverityFileLineSnippetContext
LOWgix-imara-diff/src/lib.rs113//! let after = r#"// lorem ipsumCOMMENT
LOWgix-imara-diff/src/lib.rs134//! +// lorem ipsumCOMMENT
LOWgix/tests/gix/repository/object.rs945 config.set_value(&gix::config::tree::User::EMAIL, "user@example.com")?;CODE
LOWgix/tests/gix/repository/config/identity.rs23 assert_eq!(committer.email, "user@example.com", "configured user email must win");CODE
LOWgix/tests/gix/repository/config/identity.rs73 committer.email, "user@example.com",CODE
LOWgix/tests/gix/repository/config/identity.rs82 author.email, "user@example.com",CODE
LOW⚡gix-mailmap/tests/mailmap/snapshot.rs23 Some(signature("Jane Doe", "jane@example.com")),CODE
LOW⚡gix-mailmap/tests/mailmap/snapshot.rs28 Some(signature("Jane Doe", "jane@example.com")),CODE
LOW⚡gix-mailmap/tests/mailmap/snapshot.rs34 Some(signature("Jane Doe", "jane@example.com")),CODE
LOW⚡gix-mailmap/tests/mailmap/snapshot.rs63 Entry::change_name_and_email_by_name_and_email("Jane Doe", "jane@example.com", "Jane", "bugs@example.com"),CODE
LOW⚡gix-mailmap/tests/mailmap/snapshot.rs70 Entry::change_name_and_email_by_email("Jane Doe", "jane@example.com", "jane@desktop.(none)"),CODE
LOW⚡gix-mailmap/tests/mailmap/snapshot.rs72 Entry::change_name_and_email_by_email("Jane Doe", "jane@example.com", "jane@laptop.(none)"),CODE
LOW⚡gix-mailmap/tests/mailmap/parse.rs31 Entry::change_name_and_email_by_email("Jane Doe", "jane@example.com", "jane@laptop.(none)"),CODE
LOW⚡gix-mailmap/tests/mailmap/parse.rs32 Entry::change_name_and_email_by_email("Jane Doe", "jane@example.com", "jane@desktop.(none)"),CODE
LOW⚡gix-mailmap/tests/mailmap/parse.rs33 Entry::change_name_and_email_by_name_and_email("Jane Doe", "jane@example.com", "Jane", "bugs@example.com"),CODE
LOWgix-mailmap/src/lib.rs24//! assert_eq!(resolved.name, "Jane Doe");COMMENT
LOWgix-tix/src/edit/stash.rs439 git(fixture.path(), &["config", "user.email", "user@example.com"])?;CODE
LOWgix-tix/src/edit/stash.rs501 git(fixture.path(), &["config", "user.email", "user@example.com"])?;CODE
Self-Referential Comments4 hits · 12 pts
SeverityFileLineSnippetContext
MEDIUM.github/workflows/release.yml30 # Create a draft release, initially with no binary assets attached.COMMENT
MEDIUM.github/workflows/ci.yml142 # Define the wrapper script for a compiler driver (for cc1 or cc1plus). This wrapperCOMMENT
MEDIUM.github/workflows/ci.yml158 # Define the script that performs the wrapping. This script shall be run once for eachCOMMENT
MEDIUM.github/workflows/ci.yml171 # Define a helper file that, when sourced, wires up the `~/display` symlink `wrapper1`COMMENT
Hallucination Indicators1 hit · 10 pts
SeverityFileLineSnippetContext
CRITICALgix/src/submodule/mod.rs138 .try_into_recurse_submodules(self.state.repo.config.resolved.boolean("fetch.recurseSubmodules"))?,CODE
Slop Phrases4 hits · 8 pts
SeverityFileLineSnippetContext
LOWgix-merge/tests/merge/tree/mod.rs34/// 1. Add it to the `tree_baseline.sh` script and don't forget to call theCOMMENT
LOWgix-merge/tests/merge/tree/mod.rs237 "BUG: update this number, and don't forget to remove a filter in the end"CODE
MEDIUMgix/src/repository/worktree.rs56 /// It's worth noting that a *bare* repository may have one or more linked worktrees, but has no *main* worktree,COMMENT
MEDIUM.github/workflows/codeql.yml72 # If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize howCOMMENT
Synthetic Comment Markers1 hit · 8 pts
SeverityFileLineSnippetContext
HIGHgix-protocol/src/fetch/response/mod.rs31 /// The name of the ref, as requested by the client as a `want-ref` argument.COMMENT
Decorative Section Separators1 hit · 3 pts
SeverityFileLineSnippetContext
MEDIUMgix-pack/tests/pack/bundle.rs344 /// increasing pack offset ────────────────────────────────────────────────►COMMENT
TODO Padding1 hit · 2 pts
SeverityFileLineSnippetContext
LOWgix-url/src/parse.rs286 // TODO: implement UNC path special caseCOMMENT
Redundant / Tautological Comments1 hit · 2 pts
SeverityFileLineSnippetContext
LOWetc/corpus/clone-repos.sh3# Check if there is input on stdinCOMMENT